/**
 * @typedef {object} RemoteJWKSOptions
 * @property {boolean}        [cache=true]           enable response caching
 * @property {string|number}  [cacheTtl='10m']       cache lifetime (ms or duration string)
 * @property {number}         [maxCacheKeys=100]     max cached KeyObjects kept in memory (LRU eviction)
 * @property {number}         [cooldownMs=10000]     min ms between refetches on kid-miss
 * @property {number}         [timeout=5000]         fetch timeout in ms
 * @property {boolean}        [allowInsecure=false]   allow http:// URIs (default https only)
 * @property {boolean}        [staleWhileError=false] serve stale cached keys when a refetch fails
 * @property {AbortSignal}    [signal]               caller-provided AbortSignal forwarded to fetch
 * @property {Record<string, string>} [headers]      extra headers sent on the fetch request
 * @property {(header: { kid: string, alg?: string }, error: Error) => void} [onInvalidKey] called when a key cannot be resolved (kid not found or alg mismatch)
 * @property {number}         [maxResponseSize=1048576] max bytes accepted from the JWKS endpoint (default 1 MB)
 * @property {(hostname: string, url: URL) => boolean} [allowHost] gate on the destination host; return false to refuse the URI
 */
/**
 * Create a remote JWKS resolver that fetches and caches keys from `uri`.
 *
 * The returned function has the `async (header) => KeyObject` signature
 * expected by `@exortek/jws` and `@exortek/jwt` verify surfaces.
 *
 * @param {string} uri  The JWKS endpoint URL.
 * @param {RemoteJWKSOptions} [options]
 * @returns {((header: { kid: string, alg?: string }) => Promise<import('node:crypto').KeyObject>) & { reload: () => Promise<void>, cachedKids: () => string[] }}
 */
declare function createRemoteJWKS(uri: string, options?: RemoteJWKSOptions): ((header: {
    kid: string;
    alg?: string;
}) => Promise<any>) & {
    reload: () => Promise<void>;
    cachedKids: () => string[];
};
type RemoteJWKSOptions = {
    /**
     * enable response caching
     */
    cache?: boolean | undefined;
    /**
     * cache lifetime (ms or duration string)
     */
    cacheTtl?: string | number | undefined;
    /**
     * max cached KeyObjects kept in memory (LRU eviction)
     */
    maxCacheKeys?: number | undefined;
    /**
     * min ms between refetches on kid-miss
     */
    cooldownMs?: number | undefined;
    /**
     * fetch timeout in ms
     */
    timeout?: number | undefined;
    /**
     * allow http:// URIs (default https only)
     */
    allowInsecure?: boolean | undefined;
    /**
     * serve stale cached keys when a refetch fails
     */
    staleWhileError?: boolean | undefined;
    /**
     * caller-provided AbortSignal forwarded to fetch
     */
    signal?: AbortSignal;
    /**
     * extra headers sent on the fetch request
     */
    headers?: Record<string, string> | undefined;
    /**
     * called when a key cannot be resolved (kid not found or alg mismatch)
     */
    onInvalidKey?: ((header: {
        kid: string;
        alg?: string;
    }, error: Error) => void) | undefined;
    /**
     * max bytes accepted from the JWKS endpoint (default 1 MB)
     */
    maxResponseSize?: number | undefined;
    /**
     * gate on the destination host; return false to refuse the URI
     */
    allowHost?: ((hostname: string, url: URL) => boolean) | undefined;
};

export { createRemoteJWKS };
export type { RemoteJWKSOptions };